scanssh
scans the given addresses and networks for running SSH servers. It will
query their version number and displays the results in a list.
The adresses can be either specified as an IPv4 address or an CIDR like
IP prefix,
ipaddress/masklength
Additionally, the following two commands can be prefixed to the
address:
random(n[,seed])/
The random command selects random address from the address range
specified.
The arguments are as follows:
n
is the number of address to randomly create in the given network
and
seed
is a seed for the pseudo random number generator.
split(s,e)/
The split command is used to split the address range in several
unique components. This can be use to scan from serveral hosts
in parallel.
The arguments are as follows:
e
specifies the number of hosts scanning in parallel
and
s
is the number of the host this particular scan runs on.
The options are as follows:
-V
Causes
scanssh
to print its version number.
-I
Does not send an identification string. This causes the IP number
of the scanning host to be logged.
-E
Exit the program, if the file containing the addresses for exclusion
can not be found.
-R
If addresses are generated at random, this flag causes the program
to ignore excluded addresses from the exclude file. The default
behaviour is to always exclude addresses.
-h
Displays the usage of the program.
-n port
Specifies the port number to scan. Currently, only 22 or 80 are
supported. Port number 22 scans for SSH server versions and port
number 80 scans for HTTP server versions. The default is 22.
-e excludefile
Specifies the file that contains the addresses to be excluded from the scan.
The syntax is the same as for the addresses on the command line.
-b hostalias
Specifies the ip address of an interface alias from which connections
should be attempted. If
-p
is being used, both ip addresses should be the same.
-p ifaddr
Specifies the address of the local interface. This is used to speed
up the scanning by pre-probing the addresses with
TCP-SYN
packets.
The output from
scanssh
contains only IP addresses. However, the IP addresses can be
converted to names with the
logresolve(8)
tool included in the Apache webserver.
EXAMPLES
The following command scans the class C network 10.0.0.0 - 10.0.0.255:
scanssh 10.0.0.0/24
The next command uses
SYN
probes to speed up the scan
scanssh -p 10.0.0.1 192.168.0.0/16
The following command can be used in a parallel scan. Two hosts scan the specified networks randomly, where this is the first host:
